v0.0.35 - Update README with qrexec bridge docs, update start_nsigner.sh to support qrexec mode and extra args

install_qube_fips_nsigner.sh

@@ -178,6 +178,16 @@ set -euo pipefail
 export PATH="$HOME/.local/bin:$PATH"
 LISTEN_TARGET="${NSIGNER_LISTEN_TARGET:-tcp:[::]:8080}"
 
+# If first arg is "qrexec", start in unix bridge mode for Qubes qrexec.
+# Otherwise, pass any extra args through to nsigner (e.g. --allow-all).
+if [[ "${1:-}" == "qrexec" ]]; then
+  LISTEN_TARGET="unix"
+  EXTRA_ARGS="--socket-name nsigner --bridge-source-trusted"
+  shift
+else
+  EXTRA_ARGS="$*"
+fi
+
 echo "=== n_signer startup ==="
 echo "listen target: ${LISTEN_TARGET}"
 
@@ -208,7 +218,11 @@ fi
 echo
 echo "Starting signer..."
 echo "On first remote request, approve in prompt with [y] or [a]."
-exec "$HOME/.local/bin/nsigner" --listen "${LISTEN_TARGET}"
+if [[ -n "${EXTRA_ARGS}" ]]; then
+  exec "$HOME/.local/bin/nsigner" --listen "${LISTEN_TARGET}" ${EXTRA_ARGS}
+else
+  exec "$HOME/.local/bin/nsigner" --listen "${LISTEN_TARGET}"
+fi
 EOF
 
   chmod 0755 "${script_path}"